How Cloudflare detects MCP traffic and helps secure it
Most companies designed their resource permissions with a human user in mind. A senior engineer may be able to deploy to production, query a sensitive database, or revoke another user's access. Those privileges come with risk, but that risk has traditionally been bounded by two assumptions: the engineer will use human judgment, and the engineer can only act at human speed.
An engineer who sees an unexpected result will usually stop and reconsider their actions. Any human being can only click, type, and review so much in a single day. The introduction of AI agents changes both thresholds. Their decisions are nondeterministic, and they can take the same action (or invoke the same tool) indefinitely, without getting tired or stopping for lunch. A plausible — but incorrect — decision can become thousands of incorrect actions before a human notices.
Today, we're announcing new Cloudflare One capabilities to identify inspected MCP traffic, show which users and servers are generating it, and control direct connections on managed network paths. Combined with MCP Server Portals, these controls help administrators see whether agents are using an approved path, or somehow bypassing it.
Model Context Protocol (MCP) servers give agents a common way to Continue reading
Secure all your internal vibe-coded applications — in one click
AI has enabled employees across every team to build applications faster than ever before.
But that speed is also what's keeping every CISO up at night: any employee can build an application, deploy it to the public Internet, and accidentally expose internal work or company data.
Today, we're launching new tools to make it easy to keep your applications hosted on Workers private. You can now apply Cloudflare Access directly to a Worker or to every Worker in your account, so that your applications are behind your company login by default, without relying on each developer to set that up themselves.
You can now:
- Set a policy at the account level to ensure that all preview and production deployments are behind your company login by default.
- Set a policy on a single application to ensure authentication is enforced on every domain associated with it, no matter how it's deployed.
- See exactly who visits your application. Get every authenticated user’s email, name, and groups directly in your code — no JWT (JSON Web Token) validation required.
- Deploy an internal platform where every deployment is private by default. We've open-sourced an example: an internal static site platform where every Worker Continue reading
Hedge Classics 17: Strong Opinions Loosely Held
Strong opinions loosely held? This is probably not as good of an idea as it seems. Instead of producing confidence, it might produce overconfidence. Michael Natkin joins Tom and Russ to discuss the problems with this mantra.
download
Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal
At a time when looking down at our devices is a ritual in daily life, a natural phenomenon that demands our attention communally upward is a welcome event. On Wednesday, August 12, a total solar eclipse swept from the North Atlantic across Europe, moving over Iceland and northern Spain and Portugal, with a deep partial eclipse over the rest of Western Europe, all near local sunset. This was the first total solar eclipse to cross mainland Europe in twenty years, and it drew millions outdoors to witness the moon pass between Earth and the sun.
As we saw during the 2026 World Cup and the last total eclipse in 2024, online behavior is noticeably affected when an event at this scale takes place. In this blog post, we’ll use data from Cloudflare Radar to examine how Internet traffic shifted alongside the moon and the sun.
Internet traffic dips align precisely with maximum obscuration
In the figure above, we measured HTTP request volume in five-minute buckets across the affected countries on eclipse day, and compared it to a normal-day baseline. Each row is a country (except for Alaska) and each column is a five-minute slice of August 12, Continue reading
New Tool – IPsec VPN Configuration Generator (Multi-Vendor, Policy vs Route-Based Interop)
Added a new one to the Network Tools page: an IPsec VPN Configuration Generator for Cisco IOS/IOS-XE, ASA, FortiGate, Palo Alto, Juniper SRX, strongSwan/VyOS, UniFi, and pfSense/OPNsense.
The reason I built this instead of just pointing at vendor docs is the case that actually breaks real deployments: pairing a policy-based peer with a route-based one. A route-based side (VTI/tunnel interface) defaults to a catch-all 0.0.0.0/0 ↔ 0.0.0.0/0 selector, since routing decides what enters the tunnel. A policy-based peer negotiates specific proxy-IDs per subnet pair, pulled straight from its ACL. Put those two together unmodified and phase 2 negotiation just fails — no useful error, just a tunnel that won’t come up.
Certificate Transparency Monitoring is now generally available
Since we launched Certificate Transparency Monitoring in public beta in 2019, we've been emailing subscribers whenever a new TLS certificate appears in a public Certificate Transparency (CT) log for one of their domains. Today, it's turned on for more than 650,000 customer domains. It's an early warning that someone, somewhere, has issued a certificate for a hostname in your zone, giving you a chance to spot a mis-issued certificate early.
It's a useful signal, but it had a noise problem, and we felt it ourselves. Cloudflare issues a large volume of certificates on your behalf: Universal SSL renewals, certificates from Advanced Certificate Manager, and backup certificates. All of them are logged to public CT logs by design, because a certificate that isn't logged won't be trusted by major browsers like Google Chrome and Apple's Safari. So the same transparency that lets you monitor for mis-issuance also surfaces every certificate we issue for you.
And issuance isn't a one-time event. Certificates are short-lived and renew automatically: a single Universal SSL certificate can renew as often as every 60 days, up to about six times a year. That cadence is set to increase, with the CA/Browser Forum having voted to cut Continue reading
MTU Path Test — Find Where a Path Silently Fragments, Hop by Hop
MTU problems are some of the most annoying things to troubleshoot in networking, because they’re usually silent. Small packets sail through fine, everything looks healthy, and then someone complains that a specific app is slow or hanging — and it turns out one link in the path, three hops in, has an MTU 8 bytes smaller than everyone assumed. GRE, IPsec, PPPoE, a VPN overlay, a jumbo-frame config that only got applied to half the path, a VLAN tag quietly adding 4 bytes nobody accounted for, or just two vendors defining and displaying “MTU” differently (L2 vs. L3, tagged vs. untagged) — any of these can quietly clip your effective MTU, and standard ping/traceroute won’t tell you where.
Worth Reading: LLM Prompts for Network Engineers
Tony Mattke put together a long list of recommendations that might help you get more out of your LLM tokens.
Definitely worth reading instead of yelling at the stupid AI.
Compress netlab Lab Topologies with Dot Notation
netlab is using the Python Box library to make the code easier to read1. When I started the project, I hated the way you fetch values from Python dictionaries with stuff like node['ospf']['area']; Python Box lets you write node.ospf.area. Even better2, you can tell Python Box to create intermediate dictionaries as needed. node.ospf.area = 1 will automatically create the node.ospf dictionary.
But wait, there’s more (yes, we’re getting to the topic of today’s blog post): Box lets you use the same dotted notation in YAML files.
Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave
Welcome to the 25th edition of Cloudflare's DDoS Threat Report. This is the first half-year edition in the series: rather than publishing separate reports for the first and second quarters of 2026, we have combined our coverage of Q1 and Q2 into a single volume covering January through June 2026. The analysis is produced by Cloudforce One, Cloudflare’s Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network.
Key insights
- The 1 Tbps club grew. Cloudflare mitigated a combined 935 network-layer DDoS attacks exceeding 1 Tbps in the first half of 2026 and a +519% quarter-over-quarter surge between Q1 and Q2.
- The attack-vector center of gravity shifted from botnet floods to reflection and amplification. DNS-based attacks accounted for 34.3% of all network-layer activity in the first half of 2026, with DNS Floods alone climbing from 25.7% to 40.0% of network-layer attacks quarter-over-quarter. CLDAP Floods surged +580% quarter-over-quarter to become the #3 vector in Q2.
- Geopolitics and global events influence the landscape. Media, Production & Publishing held the #1 most-attacked industry crown in both quarters at 14.2% of all Continue reading
SONiC Deep Dive: Interface State Change Pipeline
Enable Interface Ethernet0
After creating VLAN 10, the next step is to enable interface Ethernet0. The baseline configuration for Ethernet0 already exists in the PORT table of CONFIG_DB. This configuration is populated during the SONiC switch startup process using the platform configuration and configuration files, including config_db.json. When the switch boots, the configuration from config_db.json is loaded into CONFIG_DB, which is implemented as a Redis database.
GONFIG_DB and APPL_DB
The SONiC command config interface startup Ethernet0
does not create the complete PORT|Ethernet0 entry to the CONFIG_DB. Instead, it
changes the administrative state of the existing port configuration. In this
example, the admin_status field of PORT|Ethernet0 is changed to up (1).
After admin_status is changed, Redis generates a notification for applications subscribed to the PORT table in CONFIG_DB (2). The Redis notification indicates that the configuration entry has changed. It identifies the affected key and the operation that occurred rather than containing the complete PORT|Ethernet0 configuration. portmgrd, running in the SWSS container, is one of the SONiC components involved in processing port configuration. portmgrd uses the notification to identify the changed key and retrieves the current field/value data from CONFIG_DB. It then processes the configuration and prepares Continue reading
On ACLs and AI-Generated Device Configurations
Last Friday, I had a lovely chat with Steinn Bjarnarson and Urs Baumann, resulting in the NetworkAutoMagic episode 11. We couldn’t avoid mentioning netlab, the seven layers of ACL hell (which is still balmy compared to the QoS hell), and the gotchas of AI-generated device configurations.
Fortunately, I don’t have to go into more details; Steinn published extensive notes, and if you don’t feel like listening to us while driving, you can waste time watching us on YouTube.
You’ve Been Running a Kubernetes Security Model in NSX and Didn’t Even Know It
One of the blockers to moving VMs off vSphere and onto Kubernetes is losing NSX and the protection it provides. Security teams that have spent years building out distributed firewall policy look at Kubernetes and are, quite understandably, alarmed by the flat network and the fact that any workload can reach any other by default.
How will they enforce east-west traffic controls? Will they be able to replicate NSX distributed firewall rules with the same granularity? What about security groups, tiered policy, and rules that travel with the workload when it moves? These are important questions that must be answered before migration can begin.
Migrate vSphere to Kubernetes with microsegmentation intact
Calico addresses vSphere to Kubernetes security concerns with a network policy model that maps directly to key features of the NSX distributed firewall (NSX DFW). Every property NSX DFW users rely on has a direct Calico equivalent: tiered governance, workload-identity enforcement, distributed kernel-level inspection, and dynamic workload grouping. Teams coming from vSphere will recognise the pattern quickly.
Let’s walk through each one in detail.
Distributed Enforcement
Traditional firewalls sit at the edge of the network. Traffic between workloads inside Continue reading
Everything we launched during Agents Week
At the beginning of Agents Week, Rita shared that agents represent the next evolution of computing: not only as a new application of AI but also as a new class of software that’s shaping how people interact with technology, and how software interacts with the Internet. Over the last year or so, we set out to explore what this shift means for developers and customers building AI-native apps and the infrastructure needed to support them. As agents become more capable and autonomous, the challenges extend beyond the models themselves — to identity, communication, orchestration, memory, observability, and security.
Over the past week we’ve shared how we’re bringing those pieces together across the Cloudflare platform to serve an Agentic Internet. Each day we presented new tools, products, and ideas toward building for an Internet where humans and agents cooperate instead of collide.
Monday, August 3
Monday focused on the foundations for building and running intelligent, autonomous apps — the runtime and infrastructure agents rely on.
Tuesday, August 4
Tuesday introduced the Agent Development Lifecycle (ADLC) and the primitives that take agentic software from prototype to production.
Wednesday, August 5
Wednesday extended Zero Trust from users and devices to agents themselves — Continue reading
Serving the most critical missions: Cloudflare for Government achieves FedRAMP Class D (High) Certified status
We believe the Internet must be a force for good, and that it requires a foundation of trust. Nowhere is that trust more critical than in public service. Government agencies are the stewards of a nation’s most sensitive data. They protect national security, critical infrastructure, and the personal information of every citizen.
Cloudflare’s mission is to help build a better Internet. A key part of that mission is giving public sector agencies the best technology to stay secure, fast, and reliable. That means meeting the highest possible standards.
Today, we are proud to announce a major milestone: Cloudflare for Government has achieved FedRAMP Class D (High) certification status. We are honored to take this step with our sponsoring agency, the National Institute of Standards and Technology, whose global mission demands the highest level of security.
We are also very excited to announce that we are using the new systems we developed for FedRAMP High as the foundation of our commitment to pursuing U.S. Department of Defense Impact Level 4 (DoD IL4) authorization. IL4 is the department’s cybersecurity standard for systems handling controlled, unclassified data. We are confident that bringing our global network to this space will change Continue reading
netlab 26.08: ArcOS, VPP (FD.io), ACLs, and DNS
netlab release 26.08 brings a few humongous additions:
- ArcOS support by @roc-ops
- VPP (FD.io) with FRR or BIRD control plane by @jbemmel
- SONiC containers (also by @roc-ops)
- IPv4/IPv6 access control lists in the routing module by @DanPartelly
But wait, there’s more:
New Financial Tools Section (Retirement Planner Is the Big One)
I mentioned in the WordPress-to-Hugo migration post that this site was going to start drifting a bit toward retirement and financial planning content alongside the usual networking stuff. Here’s the first real piece of that: a new Financial Tools section, same browser-only, nothing-sent-to-a-server philosophy as the Network Tools I’ve been building for years.
Retirement & Social Security Planner
This is the one that actually matters. It’s a full retirement dashboard — portfolio projections, Social Security claiming strategy (including spousal/survivor benefits), RMDs, a Roth conversion planner, Medicare/IRMAA cost estimates, and a Monte Carlo simulation that runs a thousand random market paths against your numbers instead of just assuming a flat return every year. I’ve been building and using a private version of this for a while now; this is that tool, cleaned up for public use. Find it at fryguy.net/financial-tools/retirement-planner.
Retiring WordPress – How I Migrated fryguy.net to Hugo (With an AI Pair Programmer)
This site has run on WordPress since basically forever. As of this week, it doesn’t anymore. Everything you’re reading is now a static Hugo site, built from Markdown, served by nginx, with no PHP and no database anywhere in the stack. Here’s why I did it, what actually moved, and how I used Claude Code as a pair programmer for most of the heavy lifting.
Why bother
Let’s be honest about how it got this bad: I didn’t keep up with it. I know. Servers don’t rot on their own — you stop patching them, stop upgrading them, and a few years later you’re staring at a stack that’s aged out from under you. The old droplet had quietly rotted underneath a site that still worked fine. Ubuntu 18.04 — EOL since 2023. PHP 7.4 — EOL since 2022, with no apt-upgrade path to anything newer (the PPA I’d have needed was frozen). MySQL 5.7 — also EOL. WordPress itself was current; everything under it wasn’t, and there was no clean patching path left, just a slow accumulation of risk on a box facing the public internet.